Vulnerability Response Assignment Rules Overview and Troubleshooting Guide<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Vulnerability Response Assignment Rules Overview/Purpose Assignment rules with Vulnerability Response in ServiceNow are used to provide an automated way to assign the different forms of Vulnerable Item records (VITs). Assignment rules can be configured with conditions, which when met kick off the related assignment logic defined within the rule. Assignment rules are also considerate of execution order, therefor only the first assignment rule with a matching condition runs against a record. Vulnerable items that are not in the Open state or have been manually assigned are always excluded. This guide will outline the use-cases and troubleshooting tips which can be applied to implement or troubleshoot assignment rules in Vulnerability Response. Prerequisites Plugin: Vulnerability Response Role requirements: sn_vul.manage_assignment_rules Use Case / When to Use Assignment rules are designed for automated assignment of VIT records entered into the system. The rules allow for granular control when directing VITs to assignment groups, as well as directing them to a catch-all group in scenarios which have not been considered. When a VIT has satisfied the criteria of the condition builder there are 3 ways which the assignment group of the VIT can be chosen by the assignment rule: User group: This option allows you to select any user groupUser group field: This option allows you to select the assignment group of the VIT based on the groups relating to the configuration item. Configuration Item: Approval GroupConfiguration Item: Assignment GroupConfiguration Item: Support Group Script: Set the assignment group of the VIT based on a custom script Step-by-step Instructions Use the filter navigator and navigate to the module: Vulnerability Response > Administration > Assignment RulesSet the condition criteria through the condition builder. The system will use this criteria when considering if a VIT will qualify for assignment through the rule.Use the 'Assign Using' drop-down menu to select the method which you plan to perform assignment through.Provide a unique execution order value for the assignment rule. Keep in mind that assignment is only performed by the first assignment rule which has had the condition satisfied. If a VIT satisfied the conditions of multiple assignment rules, the lowest execution order rule will be the only one which is applied. Optional: If many changes are happening to assignment rules and all VIT records need to be reconsidered by the assignment rules this can be done through the 'Apply Changes' UI action on the list view. Keep in mind that this operation will take some time while evaluating all VIT records against the updated assignment rules. Examples A sample scenario is below and we have configured 'Assignment Rule Demo' rule to assign records via scripted assignment when the configuration item is 'Executive Laptop'. Included is a sample script which is the expected format. When using this approach, set the assignment group to the sys_id of the intended group. Do NOT include a current.update() within the scripted section as one is already implied when this executes through the business rule. The VIT record which satisfied this criteria is now assigned to the group which matches the sys_id used by the rule (Critical Vulnerability Analyst Team) Troubleshooting Tips Assignment rules are applied to VIT records through the "Run assignment rules" which is created on the VIT table (sn_vul_vulnerable_item). If there is any doubt about the assignment group or rule which is applied to the VIT, we can check with the same method invoked by the business rule. The attached sample script can provide the output of the assignment rule + assignment group which would be returned if the VIT was re-evaluated for assignment. var gr = new GlideRecord('sn_vul_vulnerable_item'); gr.get('05fcdef91bd9fa94135e4081b24bcb9a'); gs.info(new sn_vul.AssignmentUtils().getAssignmentGroup(gr).assignment_rule); gs.info(new sn_vul.AssignmentUtils().getAssignmentGroup(gr).assignment_group); The below business rule and script include are dependencies of this feature. We suggest also checking here to be sure they match the out-of-box implementation. Business rule: Run assignment rules https://<instance_name>.service-now.com/nav_to.do?uri=sys_script.do?sys_id=ee2d2fe0e760230068c30b63c2f6a99f Script Include: sn_vul.AssignmentUtils https://<instance_name>.service-now.com/nav_to.do?uri=sys_script_include.do?sys_id=d900cfc5e760230068c30b63c2f6a92f Related articles/references Documentation: https://www.servicenow.com/docs/bundle/zurich-security-management/page/product/vulnerability-response/concept/vr-assignment-rules.html